v.fixed on 1.8.0 and 1.8.1 branches with
Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.9pre) Gecko/20061201 Firefox/1.5.0.9pre
and
Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.1pre) Gecko/20061201 BonEcho/2.0.0.1pre
No crash with testcase, but has a question.
Smaug: Attempting to drag the frame border doesn't crash, but it also does not move at all. I lose the "drag" mouse cursor after clicking on the border. Is that expected behavior? If so, we're good. It not, I need to revoke my v.fixed. Let me know. Thanks!

Sounds like a some sort of repainting issue.
But the crash itself is related to dragging the border and once the dragging starts, the border is actually deleted.
But if there isn't a crash, this particular bug should be fixed, IMO.